A ransom note is a terrible time to start improvising. Ransomware encrypts fast — often within minutes of the first foothold — and the choices made in the first hour decide whether you lose a few files or a business. Small teams rarely have a security operations centre on standby. What they can have is a written checklist, printed and taped inside a cupboard, telling everyone what to do before panic takes over.
Here is that checklist. It is no substitute for professional incident response on a serious case, but it will get you through the first day without making things worse.
Contain the infection before you investigate
Your first instinct will be to work out what happened. Resist it. Your first job is to stop the bleeding.
- Disconnect affected machines from the network — unplug the Ethernet cable and disable Wi-Fi. Physical isolation beats software isolation when you cannot fully trust the software.
- Take shared drives, NAS devices and file servers offline if they are not already encrypted. Ransomware spreads to whatever the infected account can reach.
- Disable remote access. Turn off the VPN, shut down RDP gateways, and revoke active sessions for remote workers.
- Disconnect your backup systems. If backups are reachable from the network, they are a target — and they are the thing you will need most.
- Do not power off a machine you might need to examine. Memory holds evidence that vanishes on shutdown. Power down only if a machine is actively spreading the infection and you cannot isolate it any other way.
Do not clean anything up yet
Deleting the ransom note, running a "decryption tool" you found in a forum, or reinstalling Windows on the first infected PC all feel productive. Every one of them destroys evidence you will want later. Ransom notes often carry the group's identifier, logs show how they got in, and file timestamps reveal what they touched. Leave the mess alone until someone technical has captured it.
Pull together a small response team
You need four jobs filled, even if one person wears two hats: an incident lead who makes the decisions, someone technical who understands your systems, someone handling communications with staff, customers and suppliers, and someone who talks to insurers, lawyers and law enforcement. Write down names and phone numbers now, not at two in the morning.
Everyone else should be told, briefly and plainly, to stop using company devices and wait for instructions. Ambiguity breeds rumour, and rumour creates extra work.
Report it — early, and to more than one place
Reporting feels like admitting failure. In practice it is how you get help, and sometimes it is a legal obligation.
- Your cyber insurer. Most policies require prompt notification and often have a preferred incident response vendor. Calling them first can save you a large sum in costs they would otherwise decline to cover.
- Law enforcement. National reporting bodies — the FBI's IC3 or a local field office in the United States, Action Fraud in the UK, your national CERT or CSIRT in the EU — collect the intelligence that gets these groups disrupted. They also issue case numbers that insurers and regulators frequently ask for.
- Your legal counsel. Especially if customer data, employee records or regulated information is involved. Notification duties and the rules around ransom payments vary by country and sector, and guessing is expensive. This is a "call a lawyer" moment, not a judgement call.
- Regulators. If personal data was affected and you operate under the GDPR, breach notification may be required within 72 hours of becoming aware. Your data protection officer or counsel should make that call quickly.
- Customers and partners. Not instantly, and not in a panic, but if your downtime affects them or their data they would rather hear it from you than from a news story.
Preserve evidence before you rebuild
Before anyone wipes a disk, capture what you can: memory images if you have the tools and someone who knows how to use them, copies of the ransom note, and logs from your firewall, VPN, mail gateway and endpoint protection. Build a rough timeline of when files were last modified normally.
The value here is practical, not academic. The entry point tells you what to fix. Without it you rebuild the same vulnerable network and get hit a second time, which happens far more often than people expect.
Recover in the right order
If you have clean, offline backups, you are in a strong position. Even so, rebuilding is a sequence, not a scramble.
- Build a clean environment first — wiped or new machines, patched operating systems, fresh credentials. Do not rejoin old machines until they have been rebuilt or properly verified.
- Reset credentials everywhere: domain admin, email, VPN, cloud services, backups. Assume every password an attacker could have touched is compromised.
- Restore from the most recent backup that predates the infection. Test a small set of files before committing to a full restore.
- Close the door they came through. Patch the exploited software, remove RDP exposed to the internet, switch on multi-factor authentication for email and remote access, and delete accounts that should not exist.
- Watch closely for a week or two. Re-infection is common, and the second attempt is often quieter.
On paying the ransom
Paying is a business decision with legal and ethical edges, and nobody can promise it will work. Decryptors supplied by attackers are frequently slow, incomplete or simply broken. Many law enforcement agencies advise against payment because it funds the next attack, and paying a sanctioned group can create serious legal exposure. If you are weighing it up, do so with your insurer and a lawyer involved — not quietly at three in the morning.
Write the playbook before you need it
The best time to make these decisions is on a calm Tuesday afternoon. Print a one-page version: who to call, which systems to isolate first, where the backups live and how to restore them, and current phone numbers for your insurer, your lawyer and the relevant national reporting body. Keep a copy somewhere that does not depend on the network being up, because the network is exactly what will be down.
Then do the two things that shorten this checklist the next time around. Test a restore — actually recover files, not just confirm that a backup job ran green. And turn on multi-factor authentication for email and remote access. Those two habits prevent more ransomware than any product you can buy.
And if it does happen: slow down, isolate, and call for help.
Photo: Sergei Starostin / Pexels
